feat(sdk): add captureDenials to the typed SandboxPolicy

src/core/mxc-sdk/README.md

@@ -21,6 +21,7 @@ let policy = SandboxPolicy {
     network: None,
     ui: None,
     timeout_ms: Some(10_000),
+    capture_denials: None,
 };
 let mut request = build_request(&policy, None)?;
 request.set_script("echo hello");
@@ -55,6 +56,38 @@ dirs), [`user_profile_policy`], and [`temporary_files_policy`].
 [`platform_support`] is the Rust port of `getPlatformSupport` — reports host
 support and the available containment backends.
 
+## Denial capture (Windows)
+
+`SandboxPolicy::capture_denials` enables the Windows ProcessContainer's
+learning-mode capture: the runner records every access the policy does not
+grant and writes them to a JSON denials document.
+
+```rust
+use mxc_sdk::policy::{CaptureDenialsMode, CaptureDenialsSection};
+use mxc_sdk::SandboxPolicy;
+
+let policy = SandboxPolicy {
+    version: "0.7.0-alpha".to_string(),
+    filesystem: None,
+    network: None,
+    ui: None,
+    timeout_ms: None,
+    capture_denials: Some(CaptureDenialsSection {
+        // `Block` (the default) keeps deny-by-default and records the denial;
+        // `Allow` runs permissively and records what *would* have been denied.
+        mode: CaptureDenialsMode::Block,
+        // Absolute path; a per-run id is stamped into the stem
+        // (`denials.json` -> `denials.<run-id>.json`). `None` uses a managed temp.
+        output_path: None,
+    }),
+};
+```
+
+`Allow` relaxes containment for the run — it is reported through `warnings()`.
+Read the resulting file path and denial summary from `output_metadata()` after
+the process terminates. The section is ignored on Linux and macOS, whose
+backends have no learning-mode API.
+
 ## Live stdio + kill (streaming)
 
 [`spawn_sandbox`] returns a [`Sandbox`] you can drive
@@ -71,6 +104,7 @@ let policy = SandboxPolicy {
     network: None,
     ui: None,
     timeout_ms: None,
+    capture_denials: None,
 };
 let mut request = build_request(&policy, None)?;
 request.set_script("cat"); // echoes stdin until EOF

src/core/mxc-sdk/src/lib.rs

@@ -24,6 +24,7 @@
 //!     network: None,
 //!     ui: None,
 //!     timeout_ms: None,
+//!     capture_denials: None,
 //! };
 //! let mut request = build_request(&policy, None)?;
 //! request.set_script("echo hi");
@@ -66,6 +67,7 @@
 //! # let policy = SandboxPolicy {
 //! #     version: "0.7.0-alpha".to_string(),
 //! #     filesystem: None, network: None, ui: None, timeout_ms: None,
+//! #     capture_denials: None,
 //! # };
 //! // Run a command inside a WSL container (Windows, --features wslc).
 //! let wslc = WslcSection { image: "python:3.12".to_string(), ..Default::default() };

src/core/mxc-sdk/tests/sandbox.rs

@@ -32,6 +32,7 @@ fn seatbelt_request(command: &str, timeout_ms: u32) -> SandboxRequest {
         } else {
             Some(timeout_ms)
         },
+        capture_denials: None,
     };
     let mut request = build_request(&policy, None).expect("build_request should succeed");
     request.set_script(command);
@@ -57,6 +58,7 @@ fn process_container_request(version: &str, command: &str, timeout_ms: u32) -> S
         } else {
             Some(timeout_ms)
         },
+        capture_denials: None,
     };
     let mut request = build_request(&policy, None).expect("build_request should succeed");
     request.set_script(command);
@@ -123,6 +125,7 @@ fn version_older_than_supported_is_rejected() {
         network: None,
         ui: None,
         timeout_ms: None,
+        capture_denials: None,
     };
 
     let err =

src/core/mxc-sdk/tests/sdk_helpers.rs

@@ -127,6 +127,7 @@ fn build_request_rejects_empty_version() {
         network: None,
         ui: None,
         timeout_ms: None,
+        capture_denials: None,
     };
 
     let err = build_request(&policy, None).expect_err("an empty policy version must be rejected");
@@ -147,6 +148,7 @@ fn build_request_host_rules_require_outbound() {
         }),
         ui: None,
         timeout_ms: None,
+        capture_denials: None,
     };
 
     // Unix backends accept host rules without `allowOutbound`; only Windows
@@ -179,6 +181,7 @@ fn build_request_then_run_seatbelt() {
         network: None,
         ui: None,
         timeout_ms: Some(10000),
+        capture_denials: None,
     };
 
     let mut request = build_request(&policy, None).expect("build_request should succeed");

src/core/mxc-sdk/tests/streaming.rs

@@ -31,6 +31,7 @@ fn seatbelt_request(command: &str, timeout_ms: u32) -> SandboxRequest {
         } else {
             Some(timeout_ms)
         },
+        capture_denials: None,
     };
     let mut request = build_request(&policy, None).expect("build_request should succeed");
     request.set_script(command);

src/core/mxc-sdk/tests/streaming_processcontainer.rs

@@ -27,6 +27,7 @@ fn streaming_processcontainer_bidirectional_stdio() {
         network: None,
         ui: None,
         timeout_ms: None,
+        capture_denials: None,
     };
     let mut request = build_request(&policy, None).expect("build_request");
     // `cmd /c more` echoes stdin to stdout until EOF, then exits.

src/core/mxc_engine/src/dispatch.rs

@@ -269,6 +269,7 @@ mod tests {
             network: None,
             ui: None,
             timeout_ms: None,
+            capture_denials: None,
         }
     }
 
@@ -329,6 +330,7 @@ mod tests {
             network: None,
             ui: None,
             timeout_ms: None,
+            capture_denials: None,
         };
         let mut request = build_request(&policy, None).expect("build_request");
         request.set_script("echo hi");